Privacy Policy

Kinneko Corporate Services Company (“we”, “us”) operates Smart Comsec, a company secretarial workspace used by our staff to prepare and maintain statutory registers for client companies. We act as the data user for staff account data, and as a service provider processing client records on our clients’ instructions.

Privacy questions, access requests and correction requests: info@goldcataccouting.com.

• Statutory filings and corporate documents uploaded by staff: NNC1, NAR1, NSC1, ND2A, NR1, instruments of transfer, certificates of incorporation and certificates of incumbency (including non-Hong Kong jurisdictions such as the BVI).
• Identity documents of directors, company secretaries, shareholders and significant controllers (HKID, passport, 往來港澳通行證), and address proofs.
• Personal data contained in those documents: full names, identity or passport numbers and place of issue, residential and correspondence addresses, dates of appointment and cessation, shareholdings and beneficial interests.
• Account data for authorised staff: email address, authentication identifiers, role, and basic activity such as the time of the last save.
• Technical data: essential session storage, and optional analytics if you accept it.

Uploaded pages are transmitted to Google’s Gemini model for automated extraction of structured register data. The structured output (companies, officers, shareholders, share movements, registered office history) is saved to our database. Source PDFs and images are not persisted in the database; they exist only for the duration of processing and in your browser while a batch is staged.

Automated extraction is assistive. Staff review and correct extracted entries before a register is issued; no legal consequence is decided by automated processing alone.

Data is held in a managed PostgreSQL database with row-level security enabled. Access is restricted to an explicit allowlist of approved staff accounts; a signed-in account that is not on the allowlist receives no data at the database level. Data is encrypted in transit (TLS) and at rest by the hosting provider.

Client records and the personal data within them are retained for seven (7) years after the engagement ends, consistent with Hong Kong anti-money-laundering record-keeping expectations (AMLO, Cap. 615) and company records practice. After that period, records are deleted or anonymised. We will delete earlier on a client’s documented instruction where no statutory retention duty applies.

Staff account records are deleted when access is revoked.

We do not sell personal data. We share it only with: our cloud hosting and database provider; the AI extraction provider described above; and government bodies such as the Companies Registry where a filing or lawful request requires it.

Under the Personal Data (Privacy) Ordinance (Cap. 486) you may request access to the personal data we hold about you and request correction of inaccurate data. Send requests to info@goldcataccouting.com; we respond within 40 days as required by the Ordinance and may charge a reasonable fee for complying with a data access request.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

Strictly necessary storage keeps you signed in and caches your working data locally. Optional analytics cookies load only after you accept them in the cookie banner; your choice is stored in your browser and can be changed at any time using the Cookie settings link in the footer.

We may update this policy as the service changes. The “last updated” date above always reflects the current version.